You do not need to suffix the username if you set to context from your application.
I.e. you can send along a scope that tells zitadel which org to use. (in that case we can render the suffix on our own and only require the username)
Without the context zitadel always requires the full login name to do the domain/user discovery.